registry / lmnr-cli / 0.3.0

lmnr-cli@0.3.0

⚠ Under review

CLI for the Laminar agent observability platform

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 137 KB of source, external domains: api.lmnr.ai, laminar.sh

Source & flagged code

2 flagged

dist/index.cjsView file

Lines 29-69javascript

29path = __toESM(path);

30let pino = require("pino");

31let pino$3 = __toESM(pino, 1);

32pino = __toESM(pino);

33let pino_pretty = require("pino-pretty");

34let node_fs_promises = require("node:fs/promises");

35let node_path = require("node:path");

36let node_os = require("node:os");

37let picocolors = require("picocolors");

38let csv_parser = require("csv-parser");

39csv_parser = __toESM(csv_parser);

40let export_to_csv = require("export-to-csv");

41let fs_promises = require("fs/promises");

42fs_promises = __toESM(fs_promises);

43let cli_table3 = require("cli-table3");

44cli_table3 = __toESM(cli_table3);

45let node_crypto = require("node:crypto");

46let open = require("open");

47open = __toESM(open);

48let node_fs = require("node:fs");

49let node_readline_promises = require("node:readline/promises");

50let node_child_process = require("node:child_process");

51let node_util = require("node:util");

52let giget = require("giget");

53//#region ../types/dist/index.mjs

54/** Directory the debug-session file lives in, relative to the working dir. */

55const DEBUG_SESSION_DIR = ".lmnr";

56/** Filename of the debug-session file inside {@link DEBUG_SESSION_DIR}. */

57const DEBUG_SESSION_FILE = "debug-session.json";

58const errorMessage = (error) => error instanceof Error ? error.message : String(error);

59//#endregion

60//#region package.json

61var version$1 = "0.3.0";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.cjsView on unpkg · L49

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L49

62//#endregion

63//#region ../../node_modules/.pnpm/dotenv@17.4.2/node_modules/dotenv/lib/main.js

64var require_main = /* @__PURE__ */ __commonJSMin(((exports, module) => {

65 const fs$1 = require("fs");

66 const path$1 = require("path");

67 const os = require("os");

68 const crypto$1 = require("crypto");

69 const TIPS = [

Source & flagged code

2 flagged · loading source

dist/index.cjsView file

49let node_readline_promises = require("node:readline/promises"); L50: let node_child_process = require("node:child_process"); L51: let node_util = require("node:util"); ... L59: //#endregion L60: //#region package.json L61: var version$1 = "0.3.0"; ... L92: function supportsAnsi() { L93: return process.stdout.isTTY; L94: } ... L123: if (!result.parsed) { L124: const err = /* @__PURE__ */ new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L125: err.code = "MISSING_DATA";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.cjsView on unpkg · L49

49Trigger-reachable chain: manifest.main -> dist/index.cjs L49: let node_readline_promises = require("node:readline/promises"); L50: let node_child_process = require("node:child_process"); L51: let node_util = require("node:util"); ... L59: //#endregion L60: //#region package.json L61: var version$1 = "0.3.0"; ... L92: function supportsAnsi() { L93: return process.stdout.isTTY; L94: } ... L123: if (!result.parsed) { L124: const err = /* @__PURE__ */ new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L125: err.code = "MISSING_DATA";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L49

Findings

2 Critical3 Medium4 Low

CriticalCredential Exfiltrationdist/index.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.cjsView file

Lines 29-69javascript

29path = __toESM(path);

30let pino = require("pino");

31let pino$3 = __toESM(pino, 1);

32pino = __toESM(pino);

33let pino_pretty = require("pino-pretty");

34let node_fs_promises = require("node:fs/promises");

35let node_path = require("node:path");

36let node_os = require("node:os");

37let picocolors = require("picocolors");

38let csv_parser = require("csv-parser");

39csv_parser = __toESM(csv_parser);

40let export_to_csv = require("export-to-csv");

41let fs_promises = require("fs/promises");

42fs_promises = __toESM(fs_promises);

43let cli_table3 = require("cli-table3");

44cli_table3 = __toESM(cli_table3);

45let node_crypto = require("node:crypto");

46let open = require("open");

47open = __toESM(open);

48let node_fs = require("node:fs");

49let node_readline_promises = require("node:readline/promises");

50let node_child_process = require("node:child_process");

51let node_util = require("node:util");

52let giget = require("giget");

53//#region ../types/dist/index.mjs

54/** Directory the debug-session file lives in, relative to the working dir. */

55const DEBUG_SESSION_DIR = ".lmnr";

56/** Filename of the debug-session file inside {@link DEBUG_SESSION_DIR}. */

57const DEBUG_SESSION_FILE = "debug-session.json";

58const errorMessage = (error) => error instanceof Error ? error.message : String(error);

59//#endregion

60//#region package.json

61var version$1 = "0.3.0";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.cjsView on unpkg · L49

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L49

62//#endregion

63//#region ../../node_modules/.pnpm/dotenv@17.4.2/node_modules/dotenv/lib/main.js

64var require_main = /* @__PURE__ */ __commonJSMin(((exports, module) => {

65 const fs$1 = require("fs");

66 const path$1 = require("path");

67 const os = require("os");

68 const crypto$1 = require("crypto");

69 const TIPS = [